fix(security): clear 3 critical dependabot alerts (shell-quote, vitest)#4351
Merged
Conversation
Resolves all 3 critical Dependabot alerts without changing runtime behavior: - shell-quote 1.8.3 -> 1.8.4 (root + pro-test) via overrides. It is a transitive peer dep of the dead react-devtools-core/react-native tree; the bump is a security patch with no runtime impact. (#140, #141, GHSA-w7jw-789q-3m8p) - vitest ^2.1.2 -> ^3.2.6 (consumer-prices-core), a dev-only test tool. All 54 tests pass and `tsc` builds clean under v3; zero production dependencies changed and no CI job runs it. (#139, GHSA-5xrq-8626-4rwp) Also folded in, since it was the sole remaining blocker keeping the security-audit gate red on every PR: - undici 7.24.5 -> 7.28.0 (scripts), an in-range (^7.x) direct-dep patch for the SOCKS5 ProxyAgent TLS bypass (GHSA-vmh5-mc38-953g, high). Removed the now-obsolete GHSA-w7jw-789q-3m8p baseline entries from audit-production-dependencies.mjs (shell-quote is patched, not deferred) and re-pointed the two baseline tests at advisories that are still baselined. Full audit matrix passes exit=0 across all 6 workspaces; lockfiles are idempotent (npm ci-safe). Claude-Session: https://claude.ai/code/session_01JWozy1k6rwrf6ENB3XSJDR
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Greptile SummaryThis PR resolves three Dependabot alerts and one npm-audit-only advisory via targeted dependency overrides and direct version bumps, with corresponding updates to the security-audit baseline and its unit tests. No production code or runtime artifacts are changed.
Confidence Score: 5/5Safe to merge — all changes are dependency overrides and lockfile updates with no production code or runtime artifact modifications. All three package changes are constrained to dev tooling or transitive peer deps that never reach the web/Vite production bundle. The shell-quote overrides are purely additive. The vitest 2→3 major bump is dev-only; the consumer-prices-core build artifact is produced by tsc and is unaffected. The undici bump is a semver-compatible patch within the same major. The baseline removals and test rewrites are logically consistent with the patched state of the repo. No files require special attention. The large consumer-prices-core lockfile churn is expected from a vitest major version bump pulling in updated rollup native binaries. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Dependabot Alerts #139 #140 #141] --> B{Fix Strategy}
B --> C[shell-quote 1.8.3 → 1.8.4\nvia npm overrides]
B --> D[vitest ^2.1.2 → ^3.2.6\nconsumer-prices-core devDep]
B --> E[undici ^7.0.0 → ^7.28.0\nscripts direct dep]
C --> C1[root package.json\noverrides: shell-quote ^1.8.4]
C --> C2[pro-test/package.json\noverrides: shell-quote 1.8.4]
C1 --> F[Remove GHSA-w7jw-789q-3m8p\nfrom audit baseline]
C2 --> F
F --> G[Update baseline tests\nre-point to @clerk advisories]
D --> D1[54 tests pass\ntsc build unaffected]
E --> E1[Fixes SOCKS5 TLS-bypass\nGHSA-vmh5-mc38-953g]
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
A[Dependabot Alerts #139 #140 #141] --> B{Fix Strategy}
B --> C[shell-quote 1.8.3 → 1.8.4\nvia npm overrides]
B --> D[vitest ^2.1.2 → ^3.2.6\nconsumer-prices-core devDep]
B --> E[undici ^7.0.0 → ^7.28.0\nscripts direct dep]
C --> C1[root package.json\noverrides: shell-quote ^1.8.4]
C --> C2[pro-test/package.json\noverrides: shell-quote 1.8.4]
C1 --> F[Remove GHSA-w7jw-789q-3m8p\nfrom audit baseline]
C2 --> F
F --> G[Update baseline tests\nre-point to @clerk advisories]
D --> D1[54 tests pass\ntsc build unaffected]
E --> E1[Fixes SOCKS5 TLS-bypass\nGHSA-vmh5-mc38-953g]
Reviews (1): Last reviewed commit: "fix(security): clear critical dependabot..." | Re-trigger Greptile |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves all 3 critical Dependabot alerts with surgical, behavior-preserving changes.
shell-quote1.8.3 → 1.8.4 (root)overridesreact-devtools-core/react-native treeshell-quote1.8.3 → 1.8.4 (pro-test)overridesvitest^2.1.2→^3.2.6(consumer-prices-core)tscbuild green, 0 production deps changed, not run by any CI jobAlso folded in (the sole remaining blocker keeping the
security-auditgate red on every PR):undici7.24.5 → 7.28.0 (scripts) — in-range (^7.x) direct-dep patch for the SOCKS5 ProxyAgent TLS-bypass (GHSA-vmh5-mc38-953g, high). Not a Dependabot alert (npm-audit-only), pre-existing onmain; trivially revertible if you want criticals-only.Baseline housekeeping: removed the now-obsolete
GHSA-w7jw-789q-3m8p(shell-quote) entries fromaudit-production-dependencies.mjs— shell-quote is now patched, not deferred — and re-pointed the two baseline tests at advisories that are still baselined (@clerkon pro-test).Why behavior is unchanged
shell-quoteis dead code (react-native dev tooling never bundled in the web/vite build); patch-level bump.vitest/viteare dev-only;consumer-prices-corebuilds withtsc, so the runtime artifact is identical. No production dependency version changed in any workspace.undicibump is semver-compatible (7.24 → 7.28, same major).Test plan
exit=0across all 6 workspaces (root, scripts, consumer-prices-core, blog-site, pro-test, docker-runtime)npm ci-safe — verified via pre-pushnpm ci+ pro-test build)npm run typecheck/typecheck:api— passnpm run lint/lint:md/version:check— passnpm run test:data— 11431 pass, 0 failtests/edge-functions.test.mjs(204) — passconsumer-prices-coresuite under vitest 3 — 54 pass;tscbuild cleantests/security-audit-baseline.test.mjs— 7 pass (updated for new baseline)Dependabot will auto-close #139/#140/#141 once merged to
main.https://claude.ai/code/session_01JWozy1k6rwrf6ENB3XSJDR